# npm public package stored cross-site scripting

Source: https://junglewise.ai/threats/npm-public-package-stored-cross-site-scripting-d7e34af9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-05-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2019-05-31

The npm "public" package is vulnerable to stored cross-site scripting (XSS), allowing attackers to inject malicious JavaScript code that persists in the application and executes in users' browsers. This vulnerability affects all versions of the package, and no fix is currently available, making the package unsuitable for use until patched.

Technologies: [public (npm)](https://junglewise.ai/threats/technologies/public). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 31 May 2019.

**Which products and versions are affected?** public (npm) all versions prior to 0.1.4.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run public (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (CWE-79) flaw affecting all versions of the npm "public" library. The vulnerability allows attackers to inject malicious scripts that are stored and executed client-side in users' browsers. No preconditions such as authentication are mentioned, suggesting the vulnerability may be exploitable through untrusted input handling. At the time of publication, no patch was available; the advisory explicitly recommends against using the module until a fix is released. The vulnerability was introduced at version 0 and potentially addressed in version 0.1.4, though version 0.1.5 remains affected.

## Affected products

- npm public all versions prior to 0.1.4

## Timeline

- 2019-05-31: disclosed
- other: No fix available as of publication date

## References

- [https://hackerone.com/reports/316346](https://hackerone.com/reports/316346)
- [https://www.npmjs.com/advisories/609](https://www.npmjs.com/advisories/609)

## Related threats

- [npm public path traversal via symlink navigation](https://junglewise.ai/threats/npm-public-path-traversal-via-symlink-navigation-dd9ade29)
- [Tnantoka public reflected XSS vulnerability](https://junglewise.ai/threats/cve-2018-16480-tnantoka-public-reflected-xss-vulnerability)
- [public Cross-Site Scripting in filename handling](https://junglewise.ai/threats/cve-2018-3747-public-cross-site-scripting-in-filename-handling)
- [npm public path traversal](https://junglewise.ai/threats/cve-2018-3731-npm-public-path-traversal)